Problems with worms in Windows 2000

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

cesarcarlos

Thread Starter
Joined
Jan 11, 2004
Messages
44
Hello,

I am having so much trouble with my computer, I hope you can help me.

I am running Windows 2000 Professional and McAfee VirusScan Online.

About two weeks ago strange things began happening. Whenever I would switch my computer on everything would start fine until the point where I was asked for my user and psw. I would write them, click OK, then I would see my wallpaper image and then nothing. No Taskbar, no Icons on the desktop, no start menu, nothing. I could use the computer in restore mode where the antivirus would repeatedly detect files in C:/WINNT infected wit W32/Sdbot.worm.gen or W32/Gaobot or variations of these viruses.

I had my disk formatted and Windows reinstalled. I got the computer back yesterday. I started installing my software and suddenly McAfee VirusScan Online started detecting files infected in WINNT, like every 5 mins. Examples are:

C:\msword.dat
W32/Sdbot.worm.gen

C:\WINNT\system32\msword.exe (this one like 3 times)
W32/Sdbot.worm.gen

C:\msconfig.dat
W32/Sdbot.worm.gen

More weird, I left for a while and when I came back I found a couple of pop ups with some porn advertising. Not web ads, but system alerts. (gray boxes with text)

I tried running Stinger but that found nothing.

I went online to Trend Micro and used their online virus Scan. It found out that my Mouse Driver had within it's files this:

BKDR_SDBOT.GEN

I deleted the infected virus Trend Micro found. Looks like the pop up thing got fixed.

Apparently when I installed the mouse software the computer got infected.

I also found NewsUpd running in my computer. I used Spybot S&D to get rid of it and other spyware.

LAst night my Antivirus (McAfee VirusScan) stopped working. I tried reinstalling it but the download would stop all of a sudden. Up to this moment I haven't been able to install it again.

I went online today and talked with McAfee tech support. They told me to do a DOS Scan and gave me a zip file to download so I could do it. I did, it found a couple of viruses and deleted them. Still I couldn't reinstall McAfee.

I then noticed that whenever I run REGEDIT it closes whenever I try to open a folder or use an option from the menus.

The latest is that I can't go to McAfee's web page anymore. I can't go to computercops.biz either. I asked friends if they could and they said they could go to the site with no problem. I get the typical error window (like when you mistype an address; server may be down something like that)

I'm also noticing that I can't cut and paste text or that I can't open links in messenger windows or in Outlook Express. I click on the links and nothing happens. I have to write the address myself.

I've ran Spybot, AdAware, Stinger and HijackThis.

I don't know what else to do

Can anyone please help me? Obviously the virus is still in my system and won't leave.

More examples of infected files I've been getting are:

C/WINNT\system32\wuamgrd.exe
W32/Gaobot.worm.gen.e

C:\WINNT\system32\msconfig.dat
W32/Sdbot.worm.gen

C:\WINNT\system32\regedlt.exe
W32/Randbot.worm

C:\WINNT\system32\lsass.exe
W32/Gaobot.worm.gen.f

I hope you can help me. If you need more info just let me know.

Thank you very much

CPG
 
Joined
Feb 23, 2003
Messages
16,274
First off is Macafee fully updated ? If it is then get another cause it isn't doing the job.. Then run a full system scan at trend micro and set it to auto clean..
When complete
Please get Spybot S&D to clear out any spyware.
http://www.safer-networking.org/index.php?page=mirrors


Install the program and open it.

Before doing any scanning click Online and Search for Updates .
Put a check mark at and install all updates .
Click Check for Problems nd when the scan is finished have Spybot fix all it finds marked in red .


Then after reboot :
Download 'Hijack This! http://www.spychecker.com/program/hijackthis.html
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the " scan " button will change into a " save log " button.
Press that, save the log , load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

No members online now.
Top